Webhooks

const express = require('express');
const crypto = require('crypto');

const app = express();
const SECRET = process.env.HOPPIER_WEBHOOK_SECRET; // the whsec_… value

app.post('/hoppier/webhooks', express.raw({ type: 'application/json' }), (req, res) => {
  const header = req.get('X-Hoppier-Signature') || '';
  const parts = header.split(',').map((kv) => kv.split('='));
  const t = Number(parts.find(([k]) => k === 't')?.[1]);
  if (!t || Math.abs(Date.now() / 1000 - t) > 300) {
    return res.status(400).end(); // missing or old timestamp
  }

  const expected = crypto
    .createHmac('sha256', SECRET)
    .update(`${t}.${req.body}`) // req.body is the raw Buffer
    .digest('hex');
  const valid = parts
    .filter(([k]) => k === 'v1')
    .some(
      ([, sig]) =>
        sig.length === expected.length &&
        crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected))
    );
  if (!valid) return res.status(401).end();

  const event = JSON.parse(req.body);
  // Retries reuse the same event id: skip events you've already handled.
  if (alreadyProcessed(event.id)) return res.status(200).end();
  handleEvent(event); // keep this fast, or queue the work

  return res.status(200).end();
});

import hashlib
import hmac
import json
import os
import time

from flask import Flask, abort, request

app = Flask(__name__)
SECRET = os.environ["HOPPIER_WEBHOOK_SECRET"].encode()  # the whsec_… value


@app.post("/hoppier/webhooks")
def hoppier_webhook():
    header = request.headers.get("X-Hoppier-Signature", "")
    parts = [part.split("=", 1) for part in header.split(",") if "=" in part]
    timestamp = next((value for key, value in parts if key == "t"), "")
    signatures = [value for key, value in parts if key == "v1"]

    if not timestamp.isdigit() or abs(time.time() - int(timestamp)) > 300:
        abort(400)  # missing or old timestamp

    raw_body = request.get_data()  # the raw bytes, before any JSON parsing
    expected = hmac.new(
        SECRET, timestamp.encode() + b"." + raw_body, hashlib.sha256
    ).hexdigest()
    if not any(hmac.compare_digest(expected, sig) for sig in signatures):
        abort(401)

    event = json.loads(raw_body)
    # Retries reuse the same event id: skip events you've already handled.
    if already_processed(event["id"]):
        return "", 200
    handle_event(event)  # keep this fast, or queue the work
    return "", 200